Hostile 100% javascript Download

@squawk/airspace-data 0.5.3

Credential stealer with obfuscation

preinstall setup.mjs bootstraps Bun runtimeGitHub/npm token regex harvesting
SHA-2568b2e575ff47e091ac33791e616fdf70c66246cf61b0f54bcc0724590d4f55709
URLhttps://registry.npmjs.org/@squawk/airspace-data/-/airspace-data-0.5.3.tgz
MaleculeK(Li)O₆(C₂Ca₃CoS₃As₄Dy)H₆(Po₆Cm₂₀CrDb₁₄F₁₁Os₆)Md₃(InPa₇)

Also flagged by osv (MAL-2026-3438: Malicious code in @squawk/airspace-data (npm)) +4 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.